#ParsedReport #CompletenessHigh
31-08-2026

a fake resume invoked China’s defence-tech elite, then installed VShell

https://blog.himanshuanand.com/2026/08/a-fake-resume-invoked-chinas-defence-tech-elite-then-installed-vshell/

Report completeness: High

Actors/Campaigns:
Unc5174 (motivation: cyber_espionage)
Earth_lamia
Uat-8302
Unc6586

Threats:
Vshell
Snowlight
Goloader
Antiweibu_technique
Voidmaw_tool
React2shell_vuln

Victims:
University faculty, Academic research groups

Industry:
Energy, Government, Education, Healthcare

Geo:
China, Macau, Hong kong, Chinese, Singapore

TTPs:
Tactics: 3
Technics: 0

ChatGPT TTPs:
do not use without manual check
T1027, T1027.013, T1036, T1059.003, T1071.001, T1082, T1095, T1105, T1140, T1204.002, have more...

IOCs:
IP: 4
File: 5
Url: 2
Path: 2
Hash: 8

Soft:
Internet Explorer, Windows Defender, Linux, nginx

Algorithms:
aes, base64, aes-cbc, xor, md5, aes-256-gcm, aes-gcm, sha256

Functions:
Talos

Win API:
RUN, Beep, WSAStartup, WSASocketA, closesocket, inet_addr, gethostbyname, VirtualAlloc, GetTempPathA, wsprintfA, have more...

Languages:
python

Platforms:
cross-platform, x86

Links:
https://github.com/Esonhugh/How-AI-Kills-the-VShell/blob/Skyworship/Killing\_that\_VShell.md